You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@metron.apache.org by نوشین سادات طاهری <ta...@gmail.com> on 2016/09/27 05:31:21 UTC
HDP or Ambari
*dear all*
*Hello*
*yesterday I sent an email which ask for the Linux version. and I got some
emails which helped me a lot and some friends told me that the way I choose
was in development phase and introduced two other way: Ambari and HDP.*
*so, i go in detail and choose to not to go in dev phase, and choose one of
these two, in order to run and use metron at the first step.*
*Now, I want you ask which one is easier or easy to use, Ambari or HDP? as
a person who wants to try something for the first time.*
*thanks you all*
*regards*
*Nooshin*
Re: HDP or Ambari
Posted by "Zeolla@GMail.com" <ze...@gmail.com>.
1. Dev VM instructions
<https://github.com/apache/incubator-metron/tree/master/metron-deployment/vagrant/full-dev-platform>
2. No single package for this, no. Follow the instructions in the prior
link and ask questions here or on the HCC forums
<https://community.hortonworks.com/spaces/111/cybersecurity.html?topics=Metron&type=question>
as needed.
3. Yes, you can run metron and navigate all of the components with the dev
vm setup. If you have enough juice left in whatever system you're running
metron on, you could do whatever you want, including adding threat intel
feeds, do enrichment, test models, etc. It doesn't scale well at all
(that's what the HDP/bare metal install is for), and it's probably a better
idea to process individual PCAPs than live traffic in this scenario,
because you will probably quickly get backed up on the latter.
Jon
On Tue, Sep 27, 2016 at 8:02 AM نوشین سادات طاهری <
taheri.nooshinsadat@gmail.com> wrote:
> Hello
>
> some questions to ask:
> - Is there any single documentation (step by step) for a Metron on Dev VMs
> or each of them separately?
>
> - Is there any specific package for Dev VM+Metron? or I have to download
> them separately? Any tested link?
>
> - The last question is that, you said:"The Dev VM approach is much easier
> and I would suggest to go that path for your first time if you don't have
> data (network traffic, bro logs, syslog, etc.) to send into the cluster."
> and "the Dev VMs are useful for developers or as an initial test/proof of
> concept because it's much faster to get up and running. That approach is
> in development only in as far as the entire project is in development.".
> So, that means that, if I'll try Dev VMs, i just can to run metron and see
> its menus, or I can define information sources and connect them to the
> metron and metron process them?
>
> regards
> Nooshin
>
> On Tue, Sep 27, 2016 at 1:40 PM, Zeolla@GMail.com <ze...@gmail.com>
> wrote:
>
>> Ambari is the tool that does the HDP install. Check this out -
>> https://docs.hortonworks.com/HDPDocuments/Ambari-2.2.2.0/bk_Installing_HDP_AMB/content/index.html
>>
>> Be aware that this approach requires multiple machines (usually physical
>> for it to make sense, but you could do it with VMs) and some amount of
>> additional configuration of those machines. The dev VM approach is much
>> easier and I would suggest to go that path for your first time if you don't
>> have data (network traffic, bro logs, syslog, etc.) to send into the
>> cluster.
>>
>> Just to clarify, the dev VMs are useful for developers or as an initial
>> test/proof of concept because it's much faster to get up and running. That
>> approach is in development only in as far as the entire project is in
>> development. From my experience it is a stable, viable method to see what
>> this whole metron thing really is as a very basic poc.
>>
>> Jon
>>
>> On Tue, Sep 27, 2016, 01:31 نوشین سادات طاهری <
>> taheri.nooshinsadat@gmail.com> wrote:
>>
>>>
>>> *dear all*
>>>
>>>
>>> *Hello*
>>>
>>>
>>> *yesterday I sent an email which ask for the Linux version. and I got
>>> some emails which helped me a lot and some friends told me that the way I
>>> choose was in development phase and introduced two other way: Ambari and
>>> HDP.*
>>>
>>>
>>> *so, i go in detail and choose to not to go in dev phase, and choose one
>>> of these two, in order to run and use metron at the first step.*
>>>
>>>
>>> *Now, I want you ask which one is easier or easy to use, Ambari or HDP?
>>> as a person who wants to try something for the first time.*
>>>
>>>
>>> *thanks you all*
>>>
>>>
>>> *regards*
>>> *Nooshin*
>>>
>> --
>>
>> Jon
>>
>
> --
Jon
Re: HDP or Ambari
Posted by نوشین سادات طاهری <ta...@gmail.com>.
Hello
some questions to ask:
- Is there any single documentation (step by step) for a Metron on Dev VMs
or each of them separately?
- Is there any specific package for Dev VM+Metron? or I have to download
them separately? Any tested link?
- The last question is that, you said:"The Dev VM approach is much easier
and I would suggest to go that path for your first time if you don't have
data (network traffic, bro logs, syslog, etc.) to send into the cluster."
and "the Dev VMs are useful for developers or as an initial test/proof of
concept because it's much faster to get up and running. That approach is
in development only in as far as the entire project is in development.".
So, that means that, if I'll try Dev VMs, i just can to run metron and see
its menus, or I can define information sources and connect them to the
metron and metron process them?
regards
Nooshin
On Tue, Sep 27, 2016 at 1:40 PM, Zeolla@GMail.com <ze...@gmail.com> wrote:
> Ambari is the tool that does the HDP install. Check this out -
> https://docs.hortonworks.com/HDPDocuments/Ambari-2.2.2.0/
> bk_Installing_HDP_AMB/content/index.html
>
> Be aware that this approach requires multiple machines (usually physical
> for it to make sense, but you could do it with VMs) and some amount of
> additional configuration of those machines. The dev VM approach is much
> easier and I would suggest to go that path for your first time if you don't
> have data (network traffic, bro logs, syslog, etc.) to send into the
> cluster.
>
> Just to clarify, the dev VMs are useful for developers or as an initial
> test/proof of concept because it's much faster to get up and running. That
> approach is in development only in as far as the entire project is in
> development. From my experience it is a stable, viable method to see what
> this whole metron thing really is as a very basic poc.
>
> Jon
>
> On Tue, Sep 27, 2016, 01:31 نوشین سادات طاهری <
> taheri.nooshinsadat@gmail.com> wrote:
>
>>
>> *dear all*
>>
>>
>> *Hello*
>>
>>
>> *yesterday I sent an email which ask for the Linux version. and I got
>> some emails which helped me a lot and some friends told me that the way I
>> choose was in development phase and introduced two other way: Ambari and
>> HDP.*
>>
>>
>> *so, i go in detail and choose to not to go in dev phase, and choose one
>> of these two, in order to run and use metron at the first step.*
>>
>>
>> *Now, I want you ask which one is easier or easy to use, Ambari or HDP?
>> as a person who wants to try something for the first time.*
>>
>>
>> *thanks you all*
>>
>>
>> *regards*
>> *Nooshin*
>>
> --
>
> Jon
>
Re: HDP or Ambari
Posted by "Zeolla@GMail.com" <ze...@gmail.com>.
Ambari is the tool that does the HDP install. Check this out -
https://docs.hortonworks.com/HDPDocuments/Ambari-2.2.2.0/bk_Installing_HDP_AMB/content/index.html
Be aware that this approach requires multiple machines (usually physical
for it to make sense, but you could do it with VMs) and some amount of
additional configuration of those machines. The dev VM approach is much
easier and I would suggest to go that path for your first time if you don't
have data (network traffic, bro logs, syslog, etc.) to send into the
cluster.
Just to clarify, the dev VMs are useful for developers or as an initial
test/proof of concept because it's much faster to get up and running. That
approach is in development only in as far as the entire project is in
development. From my experience it is a stable, viable method to see what
this whole metron thing really is as a very basic poc.
Jon
On Tue, Sep 27, 2016, 01:31 نوشین سادات طاهری <ta...@gmail.com>
wrote:
>
> *dear all*
>
>
> *Hello*
>
>
> *yesterday I sent an email which ask for the Linux version. and I got some
> emails which helped me a lot and some friends told me that the way I choose
> was in development phase and introduced two other way: Ambari and HDP.*
>
>
> *so, i go in detail and choose to not to go in dev phase, and choose one
> of these two, in order to run and use metron at the first step.*
>
>
> *Now, I want you ask which one is easier or easy to use, Ambari or HDP? as
> a person who wants to try something for the first time.*
>
>
> *thanks you all*
>
>
> *regards*
> *Nooshin*
>
--
Jon